Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2024, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
9729c5c4375579bc75f478d389ee42305aacb2cf555baa5f53d520a096ead167N.exe
Resource
win7-20240903-en
General
-
Target
9729c5c4375579bc75f478d389ee42305aacb2cf555baa5f53d520a096ead167N.exe
-
Size
83KB
-
MD5
67099e34768aa6dc60c27c6519ab8850
-
SHA1
9a8144a735fc0398bde5838e4c5fb7ee6dad25b5
-
SHA256
9729c5c4375579bc75f478d389ee42305aacb2cf555baa5f53d520a096ead167
-
SHA512
977150c14647af428275398f3e95960b099898d982ccb2bb9a89fad6f3cebade1ef30d55bf32a138a2da4fb9ca6df31325c23d1c0aa886a7a942bf02fe046dc4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QM:ymb3NkkiQ3mdBjFIIp9L9QrrA8n
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4156-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3628 bhbntn.exe 2444 pjdjd.exe 2284 lfrxxff.exe 4496 thbhbh.exe 2748 vjvdj.exe 4884 xxrrfll.exe 432 tnttbb.exe 3336 5vjjp.exe 116 xrrrrfx.exe 3752 btbhnt.exe 2324 jvpdp.exe 2012 rxrxfrf.exe 3692 tnhbnh.exe 4148 xfrfrfr.exe 4744 rrlxlxl.exe 4748 bhtttn.exe 1520 jpdvv.exe 4140 bhnnnt.exe 1316 bbhnbh.exe 3432 dvppj.exe 2940 xxfffff.exe 1324 lrrxxff.exe 916 3nttnt.exe 1716 9rfflrx.exe 2572 3httth.exe 3660 dvjpj.exe 2008 llxxlrf.exe 4768 pddvd.exe 368 llrlfll.exe 740 7ttttt.exe 3484 rxlllrx.exe 1836 1rffxxl.exe 2232 hnnntn.exe 2472 jvjpp.exe 2116 rlrxflx.exe 1660 rfxflxr.exe 4952 jjpvv.exe 1576 bttttb.exe 4760 xxlllrf.exe 4320 nntbbb.exe 4380 1bhhhn.exe 3592 7vpvd.exe 2184 xxffrrx.exe 1692 bnhhhn.exe 4508 jddvp.exe 1708 9vvpp.exe 2400 xrlrffr.exe 1256 nhttbb.exe 3428 rfrrxxx.exe 3720 btbbbb.exe 2960 jjddj.exe 4428 vpddv.exe 4272 lxxflrf.exe 3736 bbnnbb.exe 1488 vpvvv.exe 640 xlxllrr.exe 4660 frllfff.exe 2032 ntthbh.exe 1336 vppdj.exe 1676 ddppp.exe 1732 xffllll.exe 2916 nhnbbh.exe 4012 btnnnt.exe 4744 dppdd.exe -
resource yara_rule behavioral2/memory/4156-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3336-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4156 wrote to memory of 3628 4156 9729c5c4375579bc75f478d389ee42305aacb2cf555baa5f53d520a096ead167N.exe 82 PID 4156 wrote to memory of 3628 4156 9729c5c4375579bc75f478d389ee42305aacb2cf555baa5f53d520a096ead167N.exe 82 PID 4156 wrote to memory of 3628 4156 9729c5c4375579bc75f478d389ee42305aacb2cf555baa5f53d520a096ead167N.exe 82 PID 3628 wrote to memory of 2444 3628 bhbntn.exe 83 PID 3628 wrote to memory of 2444 3628 bhbntn.exe 83 PID 3628 wrote to memory of 2444 3628 bhbntn.exe 83 PID 2444 wrote to memory of 2284 2444 pjdjd.exe 84 PID 2444 wrote to memory of 2284 2444 pjdjd.exe 84 PID 2444 wrote to memory of 2284 2444 pjdjd.exe 84 PID 2284 wrote to memory of 4496 2284 lfrxxff.exe 85 PID 2284 wrote to memory of 4496 2284 lfrxxff.exe 85 PID 2284 wrote to memory of 4496 2284 lfrxxff.exe 85 PID 4496 wrote to memory of 2748 4496 thbhbh.exe 86 PID 4496 wrote to memory of 2748 4496 thbhbh.exe 86 PID 4496 wrote to memory of 2748 4496 thbhbh.exe 86 PID 2748 wrote to memory of 4884 2748 vjvdj.exe 87 PID 2748 wrote to memory of 4884 2748 vjvdj.exe 87 PID 2748 wrote to memory of 4884 2748 vjvdj.exe 87 PID 4884 wrote to memory of 432 4884 xxrrfll.exe 88 PID 4884 wrote to memory of 432 4884 xxrrfll.exe 88 PID 4884 wrote to memory of 432 4884 xxrrfll.exe 88 PID 432 wrote to memory of 3336 432 tnttbb.exe 89 PID 432 wrote to memory of 3336 432 tnttbb.exe 89 PID 432 wrote to memory of 3336 432 tnttbb.exe 89 PID 3336 wrote to memory of 116 3336 5vjjp.exe 90 PID 3336 wrote to memory of 116 3336 5vjjp.exe 90 PID 3336 wrote to memory of 116 3336 5vjjp.exe 90 PID 116 wrote to memory of 3752 116 xrrrrfx.exe 91 PID 116 wrote to memory of 3752 116 xrrrrfx.exe 91 PID 116 wrote to memory of 3752 116 xrrrrfx.exe 91 PID 3752 wrote to memory of 2324 3752 btbhnt.exe 92 PID 3752 wrote to memory of 2324 3752 btbhnt.exe 92 PID 3752 wrote to memory of 2324 3752 btbhnt.exe 92 PID 2324 wrote to memory of 2012 2324 jvpdp.exe 93 PID 2324 wrote to memory of 2012 2324 jvpdp.exe 93 PID 2324 wrote to memory of 2012 2324 jvpdp.exe 93 PID 2012 wrote to memory of 3692 2012 rxrxfrf.exe 94 PID 2012 wrote to memory of 3692 2012 rxrxfrf.exe 94 PID 2012 wrote to memory of 3692 2012 rxrxfrf.exe 94 PID 3692 wrote to memory of 4148 3692 tnhbnh.exe 95 PID 3692 wrote to memory of 4148 3692 tnhbnh.exe 95 PID 3692 wrote to memory of 4148 3692 tnhbnh.exe 95 PID 4148 wrote to memory of 4744 4148 xfrfrfr.exe 96 PID 4148 wrote to memory of 4744 4148 xfrfrfr.exe 96 PID 4148 wrote to memory of 4744 4148 xfrfrfr.exe 96 PID 4744 wrote to memory of 4748 4744 rrlxlxl.exe 97 PID 4744 wrote to memory of 4748 4744 rrlxlxl.exe 97 PID 4744 wrote to memory of 4748 4744 rrlxlxl.exe 97 PID 4748 wrote to memory of 1520 4748 bhtttn.exe 98 PID 4748 wrote to memory of 1520 4748 bhtttn.exe 98 PID 4748 wrote to memory of 1520 4748 bhtttn.exe 98 PID 1520 wrote to memory of 4140 1520 jpdvv.exe 99 PID 1520 wrote to memory of 4140 1520 jpdvv.exe 99 PID 1520 wrote to memory of 4140 1520 jpdvv.exe 99 PID 4140 wrote to memory of 1316 4140 bhnnnt.exe 100 PID 4140 wrote to memory of 1316 4140 bhnnnt.exe 100 PID 4140 wrote to memory of 1316 4140 bhnnnt.exe 100 PID 1316 wrote to memory of 3432 1316 bbhnbh.exe 101 PID 1316 wrote to memory of 3432 1316 bbhnbh.exe 101 PID 1316 wrote to memory of 3432 1316 bbhnbh.exe 101 PID 3432 wrote to memory of 2940 3432 dvppj.exe 102 PID 3432 wrote to memory of 2940 3432 dvppj.exe 102 PID 3432 wrote to memory of 2940 3432 dvppj.exe 102 PID 2940 wrote to memory of 1324 2940 xxfffff.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9729c5c4375579bc75f478d389ee42305aacb2cf555baa5f53d520a096ead167N.exe"C:\Users\Admin\AppData\Local\Temp\9729c5c4375579bc75f478d389ee42305aacb2cf555baa5f53d520a096ead167N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\bhbntn.exec:\bhbntn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\pjdjd.exec:\pjdjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\lfrxxff.exec:\lfrxxff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\thbhbh.exec:\thbhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\vjvdj.exec:\vjvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\xxrrfll.exec:\xxrrfll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\tnttbb.exec:\tnttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\5vjjp.exec:\5vjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\xrrrrfx.exec:\xrrrrfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\btbhnt.exec:\btbhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\jvpdp.exec:\jvpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\rxrxfrf.exec:\rxrxfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\tnhbnh.exec:\tnhbnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\xfrfrfr.exec:\xfrfrfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\rrlxlxl.exec:\rrlxlxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\bhtttn.exec:\bhtttn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\jpdvv.exec:\jpdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\bhnnnt.exec:\bhnnnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\bbhnbh.exec:\bbhnbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\dvppj.exec:\dvppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\xxfffff.exec:\xxfffff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\lrrxxff.exec:\lrrxxff.exe23⤵
- Executes dropped EXE
PID:1324 -
\??\c:\3nttnt.exec:\3nttnt.exe24⤵
- Executes dropped EXE
PID:916 -
\??\c:\9rfflrx.exec:\9rfflrx.exe25⤵
- Executes dropped EXE
PID:1716 -
\??\c:\3httth.exec:\3httth.exe26⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dvjpj.exec:\dvjpj.exe27⤵
- Executes dropped EXE
PID:3660 -
\??\c:\llxxlrf.exec:\llxxlrf.exe28⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pddvd.exec:\pddvd.exe29⤵
- Executes dropped EXE
PID:4768 -
\??\c:\llrlfll.exec:\llrlfll.exe30⤵
- Executes dropped EXE
PID:368 -
\??\c:\7ttttt.exec:\7ttttt.exe31⤵
- Executes dropped EXE
PID:740 -
\??\c:\rxlllrx.exec:\rxlllrx.exe32⤵
- Executes dropped EXE
PID:3484 -
\??\c:\1rffxxl.exec:\1rffxxl.exe33⤵
- Executes dropped EXE
PID:1836 -
\??\c:\hnnntn.exec:\hnnntn.exe34⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jvjpp.exec:\jvjpp.exe35⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rlrxflx.exec:\rlrxflx.exe36⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rfxflxr.exec:\rfxflxr.exe37⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jjpvv.exec:\jjpvv.exe38⤵
- Executes dropped EXE
PID:4952 -
\??\c:\bttttb.exec:\bttttb.exe39⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xxlllrf.exec:\xxlllrf.exe40⤵
- Executes dropped EXE
PID:4760 -
\??\c:\nntbbb.exec:\nntbbb.exe41⤵
- Executes dropped EXE
PID:4320 -
\??\c:\1bhhhn.exec:\1bhhhn.exe42⤵
- Executes dropped EXE
PID:4380 -
\??\c:\7vpvd.exec:\7vpvd.exe43⤵
- Executes dropped EXE
PID:3592 -
\??\c:\xxffrrx.exec:\xxffrrx.exe44⤵
- Executes dropped EXE
PID:2184 -
\??\c:\bnhhhn.exec:\bnhhhn.exe45⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jddvp.exec:\jddvp.exe46⤵
- Executes dropped EXE
PID:4508 -
\??\c:\9vvpp.exec:\9vvpp.exe47⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xrlrffr.exec:\xrlrffr.exe48⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nhttbb.exec:\nhttbb.exe49⤵
- Executes dropped EXE
PID:1256 -
\??\c:\rfrrxxx.exec:\rfrrxxx.exe50⤵
- Executes dropped EXE
PID:3428 -
\??\c:\btbbbb.exec:\btbbbb.exe51⤵
- Executes dropped EXE
PID:3720 -
\??\c:\jjddj.exec:\jjddj.exe52⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vpddv.exec:\vpddv.exe53⤵
- Executes dropped EXE
PID:4428 -
\??\c:\lxxflrf.exec:\lxxflrf.exe54⤵
- Executes dropped EXE
PID:4272 -
\??\c:\bbnnbb.exec:\bbnnbb.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3736 -
\??\c:\vpvvv.exec:\vpvvv.exe56⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xlxllrr.exec:\xlxllrr.exe57⤵
- Executes dropped EXE
PID:640 -
\??\c:\frllfff.exec:\frllfff.exe58⤵
- Executes dropped EXE
PID:4660 -
\??\c:\ntthbh.exec:\ntthbh.exe59⤵
- Executes dropped EXE
PID:2032 -
\??\c:\vppdj.exec:\vppdj.exe60⤵
- Executes dropped EXE
PID:1336 -
\??\c:\ddppp.exec:\ddppp.exe61⤵
- Executes dropped EXE
PID:1676 -
\??\c:\xffllll.exec:\xffllll.exe62⤵
- Executes dropped EXE
PID:1732 -
\??\c:\nhnbbh.exec:\nhnbbh.exe63⤵
- Executes dropped EXE
PID:2916 -
\??\c:\btnnnt.exec:\btnnnt.exe64⤵
- Executes dropped EXE
PID:4012 -
\??\c:\dppdd.exec:\dppdd.exe65⤵
- Executes dropped EXE
PID:4744 -
\??\c:\fxrrlrx.exec:\fxrrlrx.exe66⤵PID:4100
-
\??\c:\lxrrfrx.exec:\lxrrfrx.exe67⤵PID:652
-
\??\c:\5hthnn.exec:\5hthnn.exe68⤵PID:4968
-
\??\c:\tnbhbh.exec:\tnbhbh.exe69⤵PID:3116
-
\??\c:\jpvjp.exec:\jpvjp.exe70⤵PID:952
-
\??\c:\lxxlrrf.exec:\lxxlrrf.exe71⤵PID:996
-
\??\c:\rrflrff.exec:\rrflrff.exe72⤵PID:1536
-
\??\c:\ntbbbb.exec:\ntbbbb.exe73⤵PID:2940
-
\??\c:\vpvdd.exec:\vpvdd.exe74⤵PID:3220
-
\??\c:\flxrffx.exec:\flxrffx.exe75⤵PID:2880
-
\??\c:\tbbttn.exec:\tbbttn.exe76⤵PID:1940
-
\??\c:\vvpvj.exec:\vvpvj.exe77⤵PID:4652
-
\??\c:\ffrrxff.exec:\ffrrxff.exe78⤵PID:2076
-
\??\c:\flrrxfl.exec:\flrrxfl.exe79⤵PID:4084
-
\??\c:\nnbbbb.exec:\nnbbbb.exe80⤵PID:664
-
\??\c:\vjddd.exec:\vjddd.exe81⤵PID:2248
-
\??\c:\rrrrxxf.exec:\rrrrxxf.exe82⤵PID:3080
-
\??\c:\bbtbnt.exec:\bbtbnt.exe83⤵PID:3440
-
\??\c:\nbhttt.exec:\nbhttt.exe84⤵PID:1636
-
\??\c:\pdppd.exec:\pdppd.exe85⤵PID:4620
-
\??\c:\rxfffxr.exec:\rxfffxr.exe86⤵PID:4472
-
\??\c:\rflllrl.exec:\rflllrl.exe87⤵PID:3292
-
\??\c:\htbthh.exec:\htbthh.exe88⤵PID:516
-
\??\c:\djdjp.exec:\djdjp.exe89⤵PID:1752
-
\??\c:\jdddd.exec:\jdddd.exe90⤵PID:4616
-
\??\c:\llrxllf.exec:\llrxllf.exe91⤵PID:4728
-
\??\c:\hnnhht.exec:\hnnhht.exe92⤵PID:1576
-
\??\c:\nbnnhn.exec:\nbnnhn.exe93⤵PID:4760
-
\??\c:\pjppp.exec:\pjppp.exe94⤵PID:4320
-
\??\c:\llrrxff.exec:\llrrxff.exe95⤵PID:4380
-
\??\c:\lffxflr.exec:\lffxflr.exe96⤵PID:3628
-
\??\c:\ttnttb.exec:\ttnttb.exe97⤵PID:400
-
\??\c:\jdpvv.exec:\jdpvv.exe98⤵PID:4312
-
\??\c:\ffrlrlx.exec:\ffrlrlx.exe99⤵PID:3392
-
\??\c:\lflxrxx.exec:\lflxrxx.exe100⤵PID:4008
-
\??\c:\ttbhhn.exec:\ttbhhn.exe101⤵PID:3356
-
\??\c:\3vdvd.exec:\3vdvd.exe102⤵PID:3636
-
\??\c:\vpppp.exec:\vpppp.exe103⤵PID:3988
-
\??\c:\rfllflr.exec:\rfllflr.exe104⤵PID:3076
-
\??\c:\1nhnnh.exec:\1nhnnh.exe105⤵PID:2488
-
\??\c:\bbbbtb.exec:\bbbbtb.exe106⤵PID:1192
-
\??\c:\dpppp.exec:\dpppp.exe107⤵PID:3400
-
\??\c:\rflfllr.exec:\rflfllr.exe108⤵PID:3144
-
\??\c:\lxrrrff.exec:\lxrrrff.exe109⤵PID:116
-
\??\c:\btnbhn.exec:\btnbhn.exe110⤵PID:2292
-
\??\c:\btbbhn.exec:\btbbhn.exe111⤵PID:2324
-
\??\c:\djjpp.exec:\djjpp.exe112⤵PID:2032
-
\??\c:\lrrrxfl.exec:\lrrrxfl.exe113⤵PID:1336
-
\??\c:\tbntbt.exec:\tbntbt.exe114⤵PID:1676
-
\??\c:\ddjjj.exec:\ddjjj.exe115⤵PID:1732
-
\??\c:\pjvvv.exec:\pjvvv.exe116⤵PID:4436
-
\??\c:\rfxxflr.exec:\rfxxflr.exe117⤵PID:2000
-
\??\c:\bnhntt.exec:\bnhntt.exe118⤵PID:2196
-
\??\c:\bthhbh.exec:\bthhbh.exe119⤵PID:1600
-
\??\c:\jjdpj.exec:\jjdpj.exe120⤵PID:3268
-
\??\c:\fllxrll.exec:\fllxrll.exe121⤵PID:652
-
\??\c:\thhnth.exec:\thhnth.exe122⤵PID:3444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-